linux/net/openvswitch
Yi-Hung Wei 11efd5cb04 openvswitch: Support conntrack zone limit
Currently, nf_conntrack_max is used to limit the maximum number of
conntrack entries in the conntrack table for every network namespace.
For the VMs and containers that reside in the same namespace,
they share the same conntrack table, and the total # of conntrack entries
for all the VMs and containers are limited by nf_conntrack_max.  In this
case, if one of the VM/container abuses the usage the conntrack entries,
it blocks the others from committing valid conntrack entries into the
conntrack table.  Even if we can possibly put the VM in different network
namespace, the current nf_conntrack_max configuration is kind of rigid
that we cannot limit different VM/container to have different # conntrack
entries.

To address the aforementioned issue, this patch proposes to have a
fine-grained mechanism that could further limit the # of conntrack entries
per-zone.  For example, we can designate different zone to different VM,
and set conntrack limit to each zone.  By providing this isolation, a
mis-behaved VM only consumes the conntrack entries in its own zone, and
it will not influence other well-behaved VMs.  Moreover, the users can
set various conntrack limit to different zone based on their preference.

The proposed implementation utilizes Netfilter's nf_conncount backend
to count the number of connections in a particular zone.  If the number of
connection is above a configured limitation, ovs will return ENOMEM to the
userspace.  If userspace does not configure the zone limit, the limit
defaults to zero that is no limitation, which is backward compatible to
the behavior without this patch.

The following high leve APIs are provided to the userspace:
  - OVS_CT_LIMIT_CMD_SET:
    * set default connection limit for all zones
    * set the connection limit for a particular zone
  - OVS_CT_LIMIT_CMD_DEL:
    * remove the connection limit for a particular zone
  - OVS_CT_LIMIT_CMD_GET:
    * get the default connection limit for all zones
    * get the connection limit for a particular zone

Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-25 16:45:19 -04:00
..
Kconfig openvswitch: Support conntrack zone limit 2018-05-25 16:45:19 -04:00
Makefile openvswitch: Add meter infrastructure 2017-11-13 10:37:07 +09:00
actions.c openvswitch: Add meter action support 2017-11-13 10:37:07 +09:00
conntrack.c openvswitch: Support conntrack zone limit 2018-05-25 16:45:19 -04:00
conntrack.h openvswitch: Support conntrack zone limit 2018-05-25 16:45:19 -04:00
datapath.c openvswitch: Support conntrack zone limit 2018-05-25 16:45:19 -04:00
datapath.h openvswitch: Support conntrack zone limit 2018-05-25 16:45:19 -04:00
dp_notify.c openvswitch: reliable interface indentification in port dumps 2017-11-05 21:49:17 +09:00
flow.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-12-22 11:16:31 -05:00
flow.h openvswitch: enable NSH support 2017-11-08 16:12:33 +09:00
flow_netlink.c openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found 2018-05-04 12:51:02 -04:00
flow_netlink.h openvswitch: enable NSH support 2017-11-08 16:12:33 +09:00
flow_table.c openvswitch: Optimize operations for OvS flow_stats. 2017-07-19 13:49:39 -07:00
flow_table.h openvswitch: Zero flows on allocation. 2015-09-22 17:33:41 -07:00
meter.c openvswitch: meter: fix the incorrect calculation of max delta_t 2018-03-11 22:48:59 -04:00
meter.h openvswitch: Add meter infrastructure 2017-11-13 10:37:07 +09:00
vport-geneve.c openvswitch: do not ignore netdev errors when creating tunnel vports 2016-08-10 23:13:23 -07:00
vport-gre.c openvswitch: do not ignore netdev errors when creating tunnel vports 2016-08-10 23:13:23 -07:00
vport-internal_dev.c net: ovs: remove unused hardirq.h 2018-01-08 20:59:25 -05:00
vport-internal_dev.h openvswitch: introduce rtnl ops stub 2014-07-01 14:40:17 -07:00
vport-netdev.c net: Add extack to upper device linking 2017-10-04 21:39:33 -07:00
vport-netdev.h openvswitch: Use dev_queue_xmit for vport send. 2015-10-22 06:46:16 -07:00
vport-vxlan.c vxlan: get rid of redundant vxlan_dev.flags 2017-06-20 13:37:02 -04:00
vport.c openvswitch: fix vport packet length check. 2018-03-08 12:50:29 -05:00
vport.h openvswitch: pass mac_proto to ovs_vport_send 2016-11-13 00:51:02 -05:00